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Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 
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The  National  Counterintelligence  Strategy  of  the  United  States  of 
America  (2008)  was  revised  in  coordination  with  the  National 
Counterintelligence  Policy  Board.  Chaired  by  the  National 
Counterintelligence  Executive,  the  National  Counterintelligence 
Policy  Board  consists  of  senior  personnel  of  departments  and 
elements  of  the  United  States  Government,  appointed  by  the 
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including  the  Joint  Chiefs  of  Staff; 
the  Department  of  Justice, 

including  the  Federal  Bureau  of  Investigation; 
the  Department  of  Energy; 
the  Department  of  Homeland  Security; 
the  Central  Intelligence  Agency. 


Preface 


This  National  Counterintelligence  Strategy  of  the  United 
States  of  America  elaborates  the  fundamental  responsibility  for  US 
intelligence  to  warn  of  and  help  prevent  terrorist  attacks  against 
the  homeland,  engage  other  asymmetric  threats,  and  provide 
reliable  intelligence  on  traditional  and  enduring  strategic  issues.  It 
also  describes  a  way  forward  by  which  the  counterintelligence 
organizations  of  the  US  government  will  engage  elements  in  the 
public  and  private  sectors  to  address  the  threat  posed  by  the 
intelligence  activities  of  foreign  powers  and  groups  and  protect  our 
nation’s  secrets  and  the  means  by  which  we  obtain  those  secrets. 

The  Strategy  has  been  produced  by  the  National 
Counterintelligence  Executive,  coordinated  across  the  counter¬ 
intelligence  elements  of  the  US  government,  and  endorsed  by  the 
National  Counterintelligence  Policy  Board. 

Approved  by  the  President  as  required  by  Section  402a  of 
Title  50  of  the  United  States  Code,  the  Strategy  provides  guidance 
for  the  conduct  of  the  counterintelligence  programs  and  activities 
of  the  US  government.  I  am  confident  that  when  implemented,  it 
will  enhance  the  integration  and  effectiveness  of  the  nation’s 
counterintelligence  elements,  as  Congress  intended  in  the  National 
Counterintelligence  Enhancement  Act  of  2002. 


J.M.  McConnell 

Director  of  National  Intelligence 
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Foreword 


Counterintelligence  is 
"information  gathered 
and  activities 
conducted  to  identify, 
deceive,  exploit, 
disrupt,  or  protect 
against  espionage, 
other  intelligence 
activities,  sabotage,  or 
assassinations  con¬ 
ducted  for  or  on  behalf 
of  foreign  powers,  or¬ 
ganizations  or  persons, 
or  their  agents,  or  in¬ 
ternational  terrorist 
activities. "  (Executive 
Order  12333,  as 
amended) 


Last  year,  with  the  support  of  the  National 
Counterintelligence  Policy  Board,  my  Office  published  and  the 
President  approved  a  substantially  revised  National 
Counterintelligence  Strategy.  We  have  reviewed  the  Strategy 
again  this  year,  as  Congress  requires,  and  have  determined  that  our 
objectives  remain  valid  for  the  coming  year.  We  have  made  minor 
adjustments  of  emphasis  in  our  discussion  of  the  objectives,  in 
particular  regarding  cyber  counterintelligence,  and  the  President 
has  approved  it  as  proposed.  Continuity  in  strategy,  planning,  and 
execution  is  important  because  we  face  continuous  threats  that 
evolve,  but  rarely  change  radically,  from  year  to  year.  The 
counterintelligence  community  will,  therefore,  continue  to 
implement  these  objectives  and  will  build  on  the  progress  achieved 
in  2007. 

In  the  past  year,  the  President  recognized  the  strategic 
importance  of  counterintelligence  by  revising  the  definition  of 
counterintelligence  in  Executive  Order  12333  to  reflect  the  full 
range  of  its  capabilities.  In  2007  and  early  2008,  we  also  saw 
significant  progress  in  the  way  we  operate  as  a  community.  For 
example,  to  execute  our  statutory  integration  function  more 
effectively,  my  Office  has  developed  more  sophisticated  measures 
of  supply  chain  risk  -  that  is,  the  risk  that  sensitive  procurements 
may  have  been  tampered  with  in  ways  that  reduce  security.  Based 
on  these  measures  and  on  more  vigorous  linkage  between  this 
Office  and  our  colleagues  throughout  the  Intelligence  Community, 
we  have  begun  to  achieve  greater  uniformity  in  the  way  the 
community  as  a  whole  deals  with  this  risk.  On  another  front,  we 
have  taken  the  lead  with  the  FBI  in  crafting  the  counterintelligence 
section  of  the  President’s  Comprehensive  National  Cybersecurity 
Initiative.  We  have  also  re-engineered  the  process  by  which  we 
conduct  damage  assessments  when  intelligence  compromises 
occur.  Each  of  these  steps  represents  concrete  progress  in 
transforming  strategic  goals  into  operational  reality.  In  the 
coming  year,  we  will  continue  to  implement  these  and  other  steps 
and  will  pay  particular  attention  to  a  welcome  initiative  by  the 
Secretary  of  Defense  to  bring  new  capabilities  and  enhanced 
strategic  coherence  to  defense  counterintelligence. 

Continuity  in  strategy,  planning  and  execution  is  important 
because  the  United  States  continues  to  face  substantial  challenges 
to  its  security,  freedom,  and  prosperity.  Transnational  terrorism, 
continued  proliferation  of  weapons  of  mass  destruction  (WMD), 
cyber  intrusions,  asymmetric  warfare,  extremist  movements,  and 
failed  states  present  severe  challenges  to  a  just  and  stable 
international  order.  Our  ability  to  meet  these  challenges  is 
threatened  by  the  intelligence  activities  of  traditional  and  non- 
traditional  adversaries.  Our  adversaries  -  foreign  intelligence 
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The  agencies  and 
departments  that  make 
up  the  counterintelli¬ 
gence  community 
derive  their  authorities 
from  the  National 
Security  Act  of  1 947, 
Executive  Order  12333, 
as  amended,  the 
Counterintelligence 
Enhancement  Act  of 
2002,  and  the 
Intelligence  Reform 
and  Terrorism 
Prevention  Act  of  2004. 


services,  terrorists,  foreign  criminal  enterprises,  and  cyber 
intruders  -  use  overt,  covert,  and  clandestine  activities  to  exploit 
and  undermine  US  national  security  interests.  Counterintelligence 
is  one  of  several  instruments  of  national  power  that  can  thwart 
such  activities,  but  its  effectiveness  depends  in  many  respects  on 
coordination  with  other  elements  of  government  and  with  the 
private  sector. 

During  the  Cold  War,  our  nation’s  adversaries  gained  access 
to  vital  secrets  of  the  most  closely  guarded  institutions  of  our 
national  security  establishment  and  penetrated  virtually  all  organi¬ 
zations  of  the  US  intelligence  and  defense  communities.  The 
resulting  losses  produced  grave  damage  to  our  national  security  in 
terms  of  secrets  compromised,  intelligence  sources  degraded,  and 
lives  lost,  and  would  have  been  catastrophic  had  we  been  at  war. 
Today  we  are  engaged  in  a  new  form  of  conflict,  fighting  terrorists 
who  have  invaded  our  nation’s  shores  and  threaten  Americans  and 
our  allies  around  the  world.  In  this  struggle  -  which  has  cultural, 
economic,  diplomatic,  and  political  as  well  as  military  dimensions 
-  the  potential  consequences  of  counterintelligence  failures  can  be 
immediate  and  devastating,  putting  in  jeopardy  our  nation’s  vital 
information,  infrastructure,  military  forces  and  a  wide  range  of  US 
interests,  technologies  and  personnel  around  the  world.  We  also 
face  a  growing  cyber  threat  to  US  government  information 
networks,  electronically  controlled  infrastructure,  and  critical 
technologies.  Unless  systematically  thwarted,  this  threat  could 
produce  a  debilitating  disruption  to  our  national  security  and 
economy. 

The  counterintelligence  community  continues  to  evolve  from 
a  confederation  toward  a  unified  enterprise,  able  to  bring  the  full 
range  of  counterintelligence  capabilities  to  bear  on  national  issues 
in  the  post  9/11  world.  The  Counterintelligence  Enhancement  Act 
of  2002,  as  amended,  and  the  Intelligence  Reform  and  Terrorism 
Prevention  Act  of  2004  accelerated  this  evolution  and  charged  the 
National  Counterintelligence  Executive  (NCIX)  with  producing  this 
National  Counterintelligence  Strategy  and  providing  the  President 
with  reports  on  its  implementation.  Despite  the  work  accomplished 
in  2007,  much  remains  undone. 

Continuing  the  process  of  integrating  the  counterintelligence 
activities  of  disparate  civilian  and  military  agencies  is  an  urgent 
national  requirement.  The  counterintelligence  community  must  do 
this  through  increasingly  rigorous  policy,  doctrine,  standards,  and 
technology,  and  by  aligning  policy  and  practice  with  the  budgetary 
and  operational  priorities  of  the  Director  of  National  Intelligence 
(DNI).  Counterintelligence  activities  must  be  orchestrated  and 
integrated  to  better  protect  America’s  secrets  and  critical  national 
assets  and  critical  infrastructure  while  providing  incisive  intelli¬ 
gence  to  national  security  decision  makers.  The  DNI’s  joint  duty 
initiative,  by  which  employees  spend  a  tour  of  duty  away  from  their 
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Counterintelligence 
activities  include  but  are 
not  limited  to  collection , 
analysis,  investigations, 
and  operations. 


The  National 
Counterintelligence 
Policy  Board  was 
authorized  by  the 
Counterintelligence 
Enhancement  Act  of 
2002.  It  serves  as  the 
principal  mechanism  for 
developing  policies  and 
procedures  for  the  ap¬ 
proval  of  the  President  to 
govern  the  conduct  of 
counterintelligence 
activities. 


home  agencies,  is  an  essential  and  promising  part  of  the 
integration  effort. 

The  counterintelligence  capabilities  of  the  United  States 
evolved  over  time  to  fit  the  shape  and  mission  of  the  disparate 
institutions  that  controlled  them.  Taken  individually,  these  capa¬ 
bilities  do  not  provide  a  response  equal  to  the  breadth  of  the 
threats  arrayed  against  the  nation,  and  they  have  not  always 
functioned  cohesively  in  support  of  focused  national  priorities. 
Furthermore,  repeated  legislation  and  executive  directives  have 
emphatically  called  attention  to  our  failure  to  align  our  activities 
and  resources  with  a  unified  national  counterintelligence  policy.  In 
2002,  Congress  created  the  position  of  the  NCIX  to  serve  as  the 
head  of  counterintelligence  for  the  US  government.  Three  years 
later,  The  Commission  on  the  Intelligence  Capabilities  of  the 
United  States  regarding  Weapons  of  Mass  Destruction 
emphatically  called  attention  to  the  failure  to  align  activities  and 
resources  with  a  unified  counterintelligence  policy  and  called  for 
the  creation  of  a  “Mission  Manager”  for  counterintelligence. 
Subsequently  in  2006,  the  DNI  named  the  NCIX  the  Mission 
Manager  for  Counterintelligence.  Consistent  with  these  authorities, 
the  NCIX  and  the  Office  of  the  NCIX  (ONCIX)  will  guide  the 
integration  of  the  counterintelligence  community  and  implement 
its  responsibilities  to  identify,  assess,  prioritize,  and  counter  the 
intelligence  threats  to  the  United  States. 

The  NCIX,  in  consultation  with  the  National  Counterintelli¬ 
gence  Policy  Board,  will  shape  and  set  priorities  for  a  unified 
national  counterintelligence  program  that  will  guide  the  conduct  of 
all  the  nation’s  counterintelligence  activities.  Moreover,  the  NCIX 
has  and  will  continue  to  engage  with  other  elements  of  the 
Intelligence  Community,  the  broader  US  government,  the  law 
enforcement  community,  the  private  sector,  and  academia  to 
thwart  intelligence  threats  directed  against  the  United  States.  Only 
through  a  unified  approach  can  the  counterintelligence  elements  of 
the  federal  government  successfully  execute  our  duties  to  enhance 
the  economic,  military,  and  political  security  of  our  nation,  the 
integrity  of  the  intelligence  system,  our  competitive  economic 
advantages,  our  armed  forces,  and  our  government’s  decision¬ 
making  processes. 

The  counterintelligence  community  has  begun  to  make 
measurable  progress  and  the  President,  Congress,  and  the  DNI 
expect  us  to  continue  do  so.  We  must  capture  our  successes  and 
efforts  in  measurable  ways.  Moreover,  because  resources  are  finite 
and  cannot  be  expected  to  grow  in  the  near  term,  the  NCIX  will 
make  the  hard  decisions  necessary  to  improve  the  efficiency  of  the 
nation’s  counterintelligence  elements.  At  the  same  time,  the  recom¬ 
mendations  resulting  from  counterintelligence  assessments  done  in 
the  wake  of  penetrations  and  unauthorized  disclosures  will  be 
followed  up  rigorously  and  monitored  to  assure  that  suitable  miti- 
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gation  measures  are  implemented.  Measurable  progress  is 
imperative  to  the  successful  implementation  of  the  Strategy’s 
objectives. 

This  National  Counterintelligence  Strategy  is  the  product 
of  an  intensive  consultation  process  across  the  Intelligence 
Community.  It  sets  forth  strategic  objectives  for  the  counterintelli¬ 
gence  community,  and  it  does  so  consistent  with  statutory 
requirements.  The  Strategy  will  guide  the  organizational, 
programmatic,  and  budgetary  priorities  of  all  counterintelligence 
elements  of  the  US  government.  It  will  do  so  consistent  with  the 
President’s  National  Security  Strategy,  the  DNI’s  National  Intelli¬ 
gence  Strategy,  and  other  applicable  guidance.  Essential  strategic 
goals  do  not  and  should  not  change  every  year;  yet  the  process  of 
risk  management  requires  that  the  counterintelligence  community 
continually  assess  challenges,  opportunities,  and  vulnerabilities. 
For  example,  in  this  annual  revision  of  the  Strategy,  countering 
cyber  threats  to  the  US  and  dealing  more  effectively  with  supply 
chain  risk  have  become  more  prominent  elements  of  our  agenda. 
My  Office  will  therefore  review  this  strategy  every  year  and, 
supported  by  the  National  Counterintelligence  Policy  Board,  will 
make  adjustments  as  circumstances  require. 


Joel  F.  Brenner 

National  Counterintelligence  Executive 
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The  Strategy 

The  nation’s  counterintelligence 
elements  will  operate  as  a  unified, 
coherent  community  and  will  jointly 
conduct  their  offensive  and  defensive 
activities  consistent  with  their  respective 
capabilities  and  authorities  and 
accomplish  their  objectives  in  accordance 
with  the  priorities  established  by  the 
National  Counterintelligence  Executive 
(NCIX). 

Secure  the  nation  against 

FOREIGN  ESPIONAGE  AND 
ELECTRONIC  PENETRATION. 

The  United  States  faces  a  wide 
range  of  threats  to  its  security  from  foreign 
intelligence  activities,  terrorist  elements, 
and  other  non-traditional  adversaries 
designed  to  achieve  advantage  over  US 
military,  diplomatic,  and  economic  inter¬ 
ests  at  home  and  abroad.  The  counterin¬ 
telligence  community  must  act  jointly  to 
understand,  confound,  manipulate,  and 
thwart  these  threats,  which  exceed  the 
ability  or  resources  of  any  single  US 
agency  or  department  to  overcome.  When 
necessary,  we  will  disrupt  these  activities 
through  arrest  and  expulsion. 

The  counterintelligence  com¬ 
munity  will  therefore  identify  and  priori¬ 
tize  adversarial  intelligence  activities 
targeting  US  interests  and  leverage  its 
collection,  analytical,  investigative,  and 
operational  resources  to  defeat  these 
activities.  We  will  also  expand  our  capa¬ 
bilities  in  cyberspace.  The  cyber  environ¬ 
ment  provides  unprecedented 
opportunities  for  adversarial  activities  and 
is  particularly  vulnerable  because  of  the 
nation’s  heavy  reliance  on  information 
systems.  A  strong  and  well-protected  US 
information  infrastructure  is  critical  to 
virtually  every  aspect  of  maintaining  our 
nation’s  security.  Trusted  insiders  as  well 
as  external  adversaries  are  targeting  the 
US  information  infrastructure  for 


exploitation,  disruption,  and  potential 
destruction.  The  counterintelligence 
community  will  exploit  and  defeat 
adversary  intelligence  activities  through 
the  application  of  the  full  range  of 
intelligence  techniques. 

In  collaboration  with  our  col¬ 
leagues  in  the  broader  Intelligence 
Community  and  pursuant  to  strategic 
threat  guidance,  counterintelligence 


The  NCIX  takes  strategic  threat  guidance 
from  the  National  Intelligence  Priorities 
Framework  (NIPF),  the  National  Threat 
Identification  and  Prioritization 
Assessment  (NTIPA),  and  other 
authorities. 


elements  will  assess  the  intelligence 
capabilities  and  activities  of  foreign  powers 
and  non-state  groups,  including  terrorists, 
and  will  describe  their  resources,  plans, 
methods  of  operations,  and  worldwide 
reach.  Foreign  intelligence  establishments 
and  terrorist  groups  acquire  resources,  train 
and  deploy  personnel,  and  execute  both 
clandestine  and  covert  intelligence 
operations  against  us.  The  counter¬ 
intelligence  community  must  understand 
who  they  are,  who  their  intelligence  allies 
are,  what  they  do,  why  they  do  it,  and  what 
they  can  do.  Counterintelligence  elements 
will  use  this  knowledge  to  direct  activities 
that  counter,  exploit,  and  defeat  adversary 
intelligence  activities  -  particularly  the 
rooting  out  of  spies  in  our  nation’s  midst. 

Accordingly,  the  counterintelli¬ 
gence  community  will  conduct  aggressive, 
strategically  directed  operations  against 
priority  intelligence  targets  around  the 
world  using  the  full  range  of  operational 
means.  The  intelligence  activities  of  for¬ 
eign  powers  afford  us  opportunities  to 
exploit  their  operations  and  gain  access  to 
their  intelligence  in  order  to  corrupt  its 
integrity.  We  will  conduct  worldwide 
operations  to  disrupt  or  defeat  our 
intelligence  adversaries  as  they  assess  and 
respond  to  the  United  States.  Each  agency 
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and  department  will  contribute  its  own 
unique  capabilities,  authorities,  and 
resources  in  a  unified  effort. 

Protect  the  integrity  of  the 
US  INTELLIGENCE  SYSTEM. 

The  US  intelligence  system  must 
provide  reliable  information  to  the  US 
government  and  its  allies.  The  integrity 
and  reliability  of  this  system  -  the  people, 
the  structure,  the  information  systems, 
and  the  information  they  hold  -  depend 
on  our  ability  to  keep  it  free  from 
penetration  or  influence.  In  pursuit  of  this 
objective,  the  counterintelligence 
community  will  work  closely  with  our 
colleagues  in  security,  acquisition, 
information  assurance,  and  other  relevant 
specialties  across  the  US  government.  The 
effectiveness  of  security  countermeasures 
in  preventing  penetration  will  be  enhanced 
by  intelligence  concerning  the  current 
nature  and  scope  of  the  adversarial  intelli¬ 
gence  threat.  No  single  department  or 
agency  alone  can  ensure  the  integrity  of 
the  US  intelligence  system  and  of  our 
critical  national  assets  and  critical 
infrastructure. 

Threats  and  vulnerabilities  are 
inherent  in  the  human  and  technological 
dimensions  of  our  culture,  practices,  stan¬ 
dards,  tradecraft,  methods,  and  resources. 
Assessing  these  threats  and  vulnerabilities 
is  an  integral  part  of  the  essential  and 
continual  task  of  risk  management. 
Recommendations  to  address  these  risks 
will  include  threat  and  vulnerability  miti¬ 
gation  measures  such  as  the  institution  of 
countermeasures,  rigorous  standards  and 
practices,  and  the  identification  of 
opportunities  for  exploitation. 

The  ability  of  foreign  powers  and 
hostile  groups  to  threaten  the  integrity  of 
the  US  intelligence  system  relies  in  part 
on  their  knowledge  of  our  security 
practices  as  well  as  intelligence  and 
counterintelligence  capabilities.  Some  of 
that  knowledge  has  been  made  available 


to  them  through  the  robust  workings  of  an 
open,  democratic,  and  remarkably  trans¬ 
parent  society.  Adversaries’  knowledge 
can  also  be  enhanced  by  accessing  our 
information  systems  and  networks,  our 
supply  chain  and  procurement  processes, 
and  our  many  scientific  and  research  and 
development  projects  where  foreign 
collaboration  is  valued  and  pursued.  That 
knowledge  has  been  profoundly  increased 
by  foreign  penetrations  of  our  own 
government  and  by  the  treasonous  acts  of 
our  own  citizens.  Thwarting  the  threat 
posed  by  foreign  intelligence  operatives 
depends  on  our  skill  in  learning  what  they 
know,  as  well  as  confirming  what  they  do 
not  know  about  us,  and  in  leveraging  and 
exploiting  that  knowledge.  That  skill 
depends  in  large  part  on  our  success  in 
penetrating  these  same  adversaries  in 
order  to  understand  their  full  range  of 
operational  and  analytical  means.  To  the 
extent  we  do  this,  we  will  better  protect 
our  own  secrets  and  decision  making 
processes  while  producing  superior 
foreign  intelligence. 

Decision  makers  require  intel¬ 
ligence  free  from  hostile  control  or 
manipulation.  Since  every  intelligence 
discipline  is  subject  to  manipulation  by 
our  adversaries,  validating  the  reliability  of 
intelligence  from  all  collection  platforms  is 
essential.  Accordingly,  each  counterintel¬ 
ligence  organization  will  validate  the  reli¬ 
ability  of  sources  and  methods  that  relate 
to  the  counterintelligence  mission  in 
accordance  with  common  standards.  For 
other  mission  areas,  the  counter¬ 
intelligence  community  will  examine 
collection,  analysis,  dissemination  prac¬ 
tices,  and  other  intelligence  activities  and 
will  recommend  and  implement  improve¬ 
ments,  best  practices,  and  common 
standards. 

Intelligence  is  vulnerable  not  only 
to  external  but  also  to  internal  threats. 
Subversion,  treason,  and  leaks  expose  our 
vulnerabilities,  our  governmental  and 
commercial  secrets,  and  our  intelligence 
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sources  and  methods.  This  insider  threat 
has  been  a  source  of  extraordinary  damage 
to  US  national  security.  Countering  this 
threat  will  require  an  aggressive  national 
effort.  In  coordination  with  organizations 
responsible  for  areas  such  as  security, 
information  assurance,  intelligence  and 
law  enforcement,  and  science  and 
technology,  the  counterintelligence 
community  must  develop  new  policies, 
tools,  and  methods  to  deter,  discover,  and 
negate  insider  threats.  For  example,  more 
sophisticated  audit  and  analytical  tools 
designed  to  discover  unexplained  patterns 
of  activities  or  anomalous  events  must  be 
put  in  place,  and  they  must  be  monitored. 
Adding  these  new  tools  and  techniques  to 
our  nation’s  existing  arsenal,  the  counter¬ 
intelligence  community  will  seek  to 
manipulate  foreign  spies,  conduct  aggres¬ 
sive  investigations,  make  arrests  and, 
where  foreign  officials  are  involved,  expel 
them  for  engaging  in  practices  inconsistent 
with  their  diplomatic  status. 

The  Intelligence  Reform  and 
Terrorism  Prevention  Act  of  2004  directed 
the  Director  of  National  Intelligence  (DNI) 
to  “ensure  maximum  availability  of  and 
access  to  intelligence  information  within 
the  intelligence  community  consistent 
with  national  security  requirements.”  The 
National  Intelligence  Strategy  responded 
to  that  directive  by  requiring  the  Intelli¬ 
gence  Community  to  ensure  that  its 
members  and  customers  “can  access  the 
information  they  need  when  they  need  it.” 
More  specifically,  we  have  been  required 
to  do  a  much  better  job  of  sharing 
information  and  to  jettison  the  notion  of 
“ownership”  of  information  -  a  notion  that 
encourages  hoarding  rather  than  sharing. 
This  mandate  will  receive  the  full  support 
of  the  counterintelligence  community.  At 
the  same  time  we  must  scrupulously  pro¬ 
tect  those  pockets  of  information  that  are 
so  sensitive  that  they  can  be  disseminated 
only  to  those  that  meet  the  criteria  for 
access.  Counterintelligence  risk  is  in 
direct  tension  with  the  seamless  sharing  of 
information.  That  is,  the  more  readily 


available  one  makes  classified 
information,  the  more  likely  it  is  to  be 
somehow  compromised,  and  the  easier  it 
is  to  steal. 

Several  espionage  cases  have 
already  highlighted  this  vulnerability  and 
have  done  incalculable  harm  to  our 
national  security.  No  counterintelligence 
official  can  guarantee  our  nation  will 
never  suffer  another  incident  of  treason  or 
espionage.  We  can,  however,  assure  the 
President,  the  Congress,  and  the 
American  people  that  we  have  measurably 
increased  the  rigor  of  our  system  of 
national  intelligence  and  have  put  in  place 
systems,  practices,  and  procedures  that 
make  foreign  penetration  more  difficult  to 
accomplish  and  easier  to  detect.  To  do 
this  we  must  expand  our  efforts  into 
cyberspace  to  counter  foreign  intelligence 
services  and  other  adversaries  who  are 
using  cyberspace  to  conduct  intelligence 
activities  directed  against  the  US.  We 
must  act  jointly  to  counter  espionage; 
those  counterintelligence  elements  that 
do  not  include  security  and  law 
enforcement  must  be  more  closely  tied  to 
their  security  and  law  enforcement 
colleagues. 

Support  national  policy  and 
decisions. 

Foreign  powers  and  adversarial 
groups  use  intelligence  activities  to 
support  their  national  security  goals, 
project  power  in  areas  of  vital  interest  and 
in  some  cases  threaten  the  national 
security  of  the  United  States  and  its  allies. 
When  understood,  these  activities  can 
provide  indications  of  their  strategic 
capabilities,  limitations,  and  plans,  and 
provide  warning  of  unacceptable 
intentions.  Such  intelligence  is  vital  to 
senior  policy  and  decision  makers  as  well 
as  mission  planners  and  operators. 

It  is  imperative  that  we  enhance 
the  Intelligence  Community’s  ability  to 
advise  our  nation’s  decision  makers  of 
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impending  threats,  vulnerabilities  and 
opportunities.  The  counterintelligence 
organizations  will  do  this  through  a  joint 
approach  to  strategic  analysis  and  by 
collaboratively  supporting  intelligence 
investigations  and  operations.  National 
security  plans,  including  counterterrorism 
and  counterproliferation  operations  and 
the  indications  and  warning  function  of 
our  nation’s  intelligence  system,  are 
vulnerable  to  foreign  intelligence  activi¬ 
ties.  As  the  intelligence  capabilities  of  our 
adversaries  evolve,  our  effectiveness  in 
thwarting  them  will  depend  on  our  ability 
to  identify  and  fill  critical  intelligence 
gaps  in  both  collection  and  analysis.  In 
meeting  these  goals,  we  will  exploit  all 
available  sources,  including  open-source 
information,  and  will  leverage  new  tech¬ 
nologies  and  relationships. 

Counterintelligence  considerations 
must  be  included  in  mission  planning  to 
ensure  that  the  operational  community  is 
aware  of  adversarial  attempts  to  manipu¬ 
late,  deceive,  or  thwart  their  missions.  As 
operations  progress,  a  continued 
counterintelligence  perspective  also 
permits  mission  planners  to  take 
advantage  of  intelligence  gathering 
opportunities  that  would  otherwise  be 
missed.  This  perspective  is  critical  as  we 
conduct  our  analysis  of  adversarial 
intelligence  services  and  their  relationship 
to  terrorist  organizations. 

The  National  Intelligence  Strategy 
directs  the  NCIX  to  support  the  analysis  of 
terror  networks.  In  coordination  with  the 
National  Counterterrorism  Center,  the 
counterintelligence  community  will  pro¬ 
duce  actionable  analysis  to  support  the 
disruption  of  terrorist  operations  and 
safeguard  US  intelligence  capabilities.  To 
further  support  counterterrorism,  the 
counterintelligence  community  will  review 
operations  and  intelligence  reporting  to 
detect  attempts  by  terrorist  entities  to 
penetrate  or  manipulate  us.  We  will  also 
assess  how  key  foreign  intelligence  ser¬ 
vices  advance  or  obstruct  US  efforts  to 


fight  terrorism  and  counter  those  activities 
that  are  hostile. 

Assessing  the  capabilities  of  foreign 
intelligence  adversaries  means  un¬ 
derstanding  their  collection  platforms  and 
their  programs  and  activities.  We  must 
know  how  they  are  structured,  how  they 
operate,  how  their  decision-making  proc¬ 
ess  works,  and  where  they  are  deployed 
against  US  interests.  This  is  both  a  collec¬ 
tion  challenge  that  the  counterintelligence 
community  must  support  and  an  ana¬ 
lytical  challenge  that  we  must  meet.  We 
will  conduct  a  common  effort  to  address 
the  most  critical  gaps  in  our  knowledge  of 
these  targets,  and,  based  on  those  gaps, 
we  will  contribute  to  the  integrated 
collection  strategies  of  the  Office  of  the 
Director  of  National  Intelligence  (ODNI). 

We  will  also  provide  strategic 
analysis,  counterintelligence  insight,  and 
policy  options  to  the  National  Security 
Council,  the  President’s  Intelligence 
Advisory  Board,  and  the  DNI  to  support 
their  national  security  deliberations.  We 
will  report  our  assessments  of  the  intelli¬ 
gence  environment  on  a  regular  basis  and 
will  suggest  actionable  alternatives  as 
appropriate. 

Even  with  the  most  rigorous  of 
security  and  counterintelligence  practices 
we  can  expect  compromises  of  classified 
information  and  operations.  We  must 
therefore  conduct  prompt  and  appropri¬ 
ately  coordinated  damage  assessments 
that  provide  a  strategic  evaluation  of  the 
risk  to  US  national  security  while  initiating 
actions  to  mitigate  damage  and  prevent 
further  loss.  In  consultation  with  the 
Department  of  Justice  in  those  cases  with 
criminal  implications  and  as  appropriate, 
the  damage  assessment  process  will  in  the 
future  begin  sooner  and  produce  results 
faster.  Merely  reporting  our  losses  is  not 
enough.  The  NCIX  will  therefore 
implement  a  follow-up  mechanism  that 
will,  in  coordination  with  the  appropriate 
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inspectors  general  and  budgetary  authori¬ 
ties,  drive  actionable  recommendations. 

Protect  US  Economic 

ADVANTAGE,  TRADE  SECRETS  AND 
KNOW-HOW. 

In  collaboration  with  our  col¬ 
leagues  throughout  the  government,  the 
counterintelligence  community  will 
protect  our  critical  national  assets  and 
critical  infrastructure  which  include 
sensitive  technologies,  key  resources, 
networks,  and  knowledge  from 
intelligence-related  attacks.  Our  water 
and  sewer  systems,  electricity  grids, 
financial  markets,  payroll  systems,  and 
air-  and  ground-traffic  control  systems  - 
to  name  only  the  most  obvious  -  are 
electronically  controlled  and  subject  to 
sophisticated  attack  by  both  state-spon¬ 
sored  and  free-lance  hackers.  The  supply 
chain  of  the  Intelligence  Community  is 
also  at  risk  of  exploitation  in  a  globalized 
marketplace.  Foreign  companies  or  US 
companies  engaged  in  overseas 
partnerships  may  become  targets  for 
exploitation  by  adversaries  seeking  to  gain 
unauthorized  or  unintended  access  to 
sensitive  US  systems  and  technologies. 
These  activities  are  designed  to  steal  our 
nation’s  intellectual  property  or  manipu¬ 
late  information  to  cause  financial  or 
logistical  chaos.  While  protecting  the 
country’s  physical  infrastructure  is  a  duty 
of  other  elements  of  the  government, 
counterintelligence  has  an  important  role 
to  play  in  understanding  who  is  planning 
and  carrying  out  those  attacks  or 
preparing  the  ability  to  do  so  in  order  to 
parry  them  and,  in  some  cases,  to  turn 
them  to  our  advantage. 

We  must  assist  in  the  identification 
and  protection  of  the  nation’s  critical 
assets  and  infrastructure,  which  reside  in 
myriad  elements  of  the  US  government, 
the  private  sector,  and  academia,  and 
whose  significance  may  be  unknown  even 
to  those  that  control  them.  Collaboration 
between  these  parties  and  counterin¬ 


telligence,  law  enforcement,  and  security 
officials  is  crucial  to  identify  those  targets 
of  interest  to  our  nation’s  adversaries.  It  is 
also  crucial  to  identify  information  that,  if 
known  to  an  adversary,  would  probably  be 
targeted  and  the  loss  or  compromise  of 
which  would  be  damaging  to  the  nation’s 
security.  Counterintelligence  elements  will 
work  with  law  enforcement  and  security  to 
develop,  sustain,  and  leverage  knowledge 
of  our  adversaries’  strategies,  collection 
priorities,  intentions,  and  technical  needs, 
and  we  will  translate  this  knowledge  into 
proposed  collection  requirements.  We  will 
also  provide  threat  information  and 
warning  to  critical  national  asset  and 
critical  infrastructure  owners,  including 
those  outside  the  US  government. 

Support  US  armed  forces. 

Counterintelligence  activities 
protect  those  who  protect  America  -  espe¬ 
cially  the  armed  forces  of  the  United 
States.  To  maintain  the  viability  of  this 
instrument  of  national  power,  the  coun¬ 
terintelligence  community  must 
neutralize  and  exploit  adversarial 
intelligence  activities  targeting  the  armed 
forces. 

The  armed  forces  have  long  been  a 
priority  target  of  terrorist  attacks  and  the 
adversarial  intelligence  activities  that  sup¬ 
port  them.  In  recent  decades  we  have 
witnessed  attacks  such  as  the  bombings  of 
the  Marine  barracks  in  Beirut,  Khobar 
Towers  in  Saudi  Arabia,  and  the  USS  Cole 
in  the  port  of  Aden.  Such  terrorist  acts  are 
always  preceded  by  intelligence  operations 
to  reconnoiter  targets  and  plan  attacks, 
and  it  is  these  operations  that  we  must 
recognize  and  thwart.  Executive  Order 
12333,  as  amended,  directs  the  nation’s 
counterintelligence  elements  to  protect 
against  espionage.  The  National 
Intelligence  Strategy  further  directs  the 
Intelligence  Community  to  “[djeploy  effec¬ 
tive  counterintelligence  measures  that 
enhance  and  protect...  our  armed 
forces...”.  In  accordance  with  these 
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mandates,  the  counterintelligence 

community  will  employ  offensive  and 
defensive  capabilities  to  neutralize  and 
exploit  the  full  spectrum  of  adversarial 
intelligence  activities  targeting  the  armed 
forces,  whether  in  garrison,  in  transit,  or  in 
their  areas  of  responsibility. 

The  counterintelligence  com¬ 

munity  will  counter  adversarial  intelli¬ 
gence  threats  to  military  plans,  operations, 
capabilities,  intentions,  and  global 

posture,  including  the  location  and 
disposition  of  forces.  Counterintelligence 
elements  will  support  the  full  gamut  of 
military  operations  from  tactical  activity  to 
strategic  initiatives.  The  armed  forces’ 
effectiveness  depends  on  their  ability  to 
conduct  military  operations  uncompro¬ 
mised  by  adversaries’  foreknowledge.  The 
obligation  to  support  such  operations 
extends  beyond  the  Department  of 
Defense  to  the  entire  counterintelligence 
community,  which  must  collaborate  to 
neutralize  adversarial  intelligence  activity 
directed  against  our  armed  forces,  espe¬ 
cially  the  intelligence  activities  that 
precede  terrorist  attacks. 

MANAGE  THE 
COUNTERINTELLIGENCE 
COMMUNITY  TO  ACHIEVE 
EFFICIENT  COORDINATION. 

The  integration  and  effective  man¬ 
agement  of  the  counterintelligence 
programs  of  the  agencies  and  departments 
of  the  Executive  Branch  is  the  NCIX’s  top 
priority.  Working  with  the  DNI  Chief 
Financial  Officer  (CFO),  the  ONCIX  will 
develop  a  plan  to  assess  current  program 
development  and  performance,  identify 
redundancy,  and  advise  the  DNI’s  CFO  of 
efficient  ways  to  apply  resources. 
Counterintelligence  elements  will  provide 
the  NCIX  with  the  resource  data  and 
operational  visibility  required  to  perform 
the  statutory  functions  of  the  office.  In 
addition,  continuity  of  operations  of 
counterintelligence  programs  during 


emergencies  and  other  contingencies  must 
be  maintained. 

Improve  training  and 

EDUCATION  OF  THE 

COUNTERINTELLIGENCE 

COMMUNITY. 

The  increasing  complexity  of 
counterintelligence  challenges  requires  us 
to  address  an  ever-expanding  range  of 
threats.  Meeting  these  emerging  threats 
demands  an  adaptive,  innovative,  and 
broadly  educated  workforce  drawn  from  a 
wide  range  of  backgrounds. 

As  directed  by  the  Counterintelli¬ 
gence  Enhancement  Act  of  2002,  as 
amended,  and  in  consultation  with  the 
counterintelligence  community,  the 
ONCIX  will  develop  policy  and  standards 
for  training  and  professional  development 
of  individuals  engaged  in  counterintelli¬ 
gence  activities.  Consistent  with  the  Intel¬ 
ligence  Community’s  Five  Year  Strategic 
Human  Capital  Plan  and  other  US  gov¬ 
ernment  efforts,  we  will  engage  in  a 
unified  effort  to  establish  best  practices, 
baseline  our  community’s  competencies, 
create  core  training  courses,  set  profes¬ 
sional  standards,  and  support  research 
initiatives.  To  the  extent  feasible,  we  will 
integrate  our  training  efforts  and 
standards  with  those  of  the  National 
Intelligence  University. 

We  will  also  develop  an  adaptable, 
expert  counterintelligence  workforce  to 
meet  the  challenge  of  evolving  intelligence 
threats.  Our  efforts  will  focus  on  three  key 
areas.  First,  we  will  recruit  personnel  with 
a  broader  range  of  skills  and  experiences 
from  outside  the  counterintelligence  com¬ 
munity.  Specifically,  we  will  target  those 
who  have  experienced  other  cultures, 
speak  other  languages,  or  have  specialized 
skills  in  information  technology.  Second, 
we  will  provide  this  cadre  with  a  core 
understanding  in  counterintelligence 
tradecraft,  building  on  best  practices  from 
across  the  community.  Third,  we  will 
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develop  structured  career  paths  that 
emphasize  professional  growth  by  identi¬ 
fying  key  assignments  and  leadership 
development  opportunities  and  by  clearly 
articulating  promotion  goals  and  stan¬ 
dards.  This  lifecycle  approach  to 
counterintelligence  careers  will  be 
grounded  in  a  rigorous  assessment  of 
needs  and  integrated  into  wider  human 
capital  development  efforts  in  the 
Intelligence  Community. 

Expand  National  Awareness 
of  Counterintelligence  Risk 
in  the  Private  as  well  as 
Public  Sector. 

In  order  to  better  fulfill  the  mission 
of  identifying,  assessing,  and  countering 
the  intelligence  threats  to  the  nation,  we 
must  reach  outward  to  other  elements  of 
the  US  government,  the  private  sector,  and 
the  general  public.  By  engaging  the 
private  sector  and  academia  in  meaningful 
dialogue,  there  is  much  we  can  learn,  and 
in  turn  we  can  provide  a  mechanism  to 
coordinate  the  public  dissemination  of 
information  on  intelligence  threats  to  the 
nation. 

Foreign  intelligence  activities 
extend  beyond  traditional  targets  in  the 
Intelligence  Community  and  other  US 
national  security  structures.  The  private 
sector  and  academia  are  fertile  breeding 
grounds  for  advanced  scientific  discovery, 
cutting-edge  technology,  and  advanced 
research  and  development  that  make  them 
irresistible  “soft  targets”  for  foreign  intel¬ 
ligence  collectors.  It  is  imperative  that  the 
American  public  understand  that  the  cyber 
networks  that  businesses,  universities,  and 
ordinary  citizens  use  every  day  are  the 
object  of  systematic  hostile  activities  by 
adversarial  intelligence  organizations,  and 
that  these  activities  threaten  the  integrity 
and  safety  of  the  nation’s  infrastructure 
and  electronic  networks.  The  counterin¬ 
telligence  community  will  engage  the 
private  sector,  academia,  and  the  general 


public  in  an  ongoing  dialogue  regarding 
the  threats  we  face  and  our  responses  to 
those  threats. 

Counterintelligence  elements  will 
work  with  willing  private  sector  and 
academic  partners  to  advance  intelligence 
community  capabilities  through  research 
and  development  and  to  anticipate  and 
identify  emerging  technical  threats. 
Where  the  counterintelligence  community 
can  form  liaisons  with  willing  partners,  it 
will  reach  outward  for  information  critical 
to  targeting  foreign  intelligence  activities 
and  defending  national  security. 

Conclusion 

These  strategic  objectives  continue 
to  guide  counterintelligence  community 
policy,  planning,  collection  priorities, 
analysis,  operations,  programming, 
budgeting,  and  execution.  The  ONCIX,  in 
consultation  with  the  National  Counterin¬ 
telligence  Policy  Board  will  oversee  the 
implementation  of  the  objectives  through 
an  integrated  counterintelligence 
community  effort  to  capitalize  on  the 
comparative  advantages  of  its  constituent 
organizations.  The  ONCIX  will  also 
continue  to  monitor  the  counter¬ 
intelligence  community’s  progress  against 
these  strategic  objectives  and  provide  our 
leaders  with  candid  and  accurate 
assessments  on  the  state  of  the 
counterintelligence  community. 
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